DPDP Act for Hospitals and Healthtech: A Practical Guide

The short answer

Hospitals, clinics, diagnostic labs, pharmacies and healthtech apps are all Data Fiduciaries under India’s DPDP Act when they process digital personal data. You need valid consent for most processing, strong security, breach reporting and a way for patients to exercise their rights. Most duties apply from 13 May 2027.

Is health data treated differently?

No. Unlike the EU GDPR, the DPDP Act has no separate category for sensitive or health data. The same rules apply to all digital personal data. In practice, health data still needs your strongest safeguards, because a breach can cause real harm, and security failures carry the highest penalty.

When you need consent, and when you do not

Consent under Section 6 is the default. Section 7 lists legitimate uses where consent is not needed, including:

• responding to a medical emergency involving a threat to the life or immediate threat to the health of the patient or another person,
• providing medical treatment or health services during an epidemic, outbreak or other threat to public health,
• where a patient voluntarily provides data for a specific purpose and has not said no to its use.

Marketing, analytics on your website, and sharing data with partners for their own purposes still need consent.

Children’s health data

Section 9 requires verifiable parental consent for anyone under 18. Rule 12 and the Fourth Schedule exempt clinical establishments, mental health establishments and healthcare professionals from this requirement when providing health services to the child, to the extent necessary to protect the child’s health. Paediatric apps that run marketing or analytics still need parental consent for those purposes. See parental consent.

Security and breaches

• Section 8(5): take reasonable security safeguards to prevent a personal data breach. Failure carries a cap of up to ₹250 crore. Read security safeguards.
• Section 8(6): notify the Board and each affected patient of any breach. Rule 7 sets out what to report. Failure to notify carries a cap of up to ₹200 crore. Read breach notification.
• Vendors: your hospital information system, lab software and cloud host are Data Processors. You stay responsible for them. See vendor obligations.

Patient rights

Patients can ask to access, correct or erase their data and raise grievances under Sections 11 to 14. Medical records you must keep under other laws can be retained, but data you no longer need should go. See handling deletion requests.

Checklist for healthcare teams

1. Map where patient data lives: HIS, lab systems, apps, WhatsApp, email.
2. Write itemised notices for appointment booking, telemedicine and apps, in the languages your patients read.
3. Block marketing and analytics trackers on your website until consent. Check with the free DPDP website scanner.
4. Review vendor contracts.
5. Set up a breach response plan.
6. Publish a grievance contact and response time.

How ConsentPlix helps

ConsentPlix handles consent on your website and booking flows, offers notices in Indian languages, keeps signed proof of each consent and gives patients a self-service rights portal. See our healthtech solution.

Checked against Act No. 22 of 2023 and the DPDP Rules 2025, as of October 2026.